9.3

CVE-2025-64513: Milvus Proxy has Critical Authentication Bypass Vulnerability

Deferred
AliasesGHSA-mhjq-8c7m-3f7pBIT-milvus-2025-64513GO-2025-4114
Published 10-11-2025Last modified 12-11-2025

Vulnerability summary

CVE-2025-64513 is a critical (CVSS 9.3) Improper Authentication vulnerability in milvus-io milvus. EPSS estimates a 0.87% chance of exploitation in the next 30 days, higher than 58.8% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 9.3 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
9.3/10
010
Critical · v4.0 (CVE.org)
EPSS score
0.87%
0%100%
Low · -0.19 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2026:21483-1

Timeline

  1. 10-11-2025
    PublishedVulnerability first disclosed.
  2. 12-11-2025
    Last modifiedVulnerability information updated.

Description

Milvus is an open-source vector database built for generative AI applications. An unauthenticated attacker can exploit a vulnerability in versions prior to 2.4.24, 2.5.21, and 2.6.5 to bypass all authentication mechanisms in the Milvus Proxy component, gaining full administrative access to the Milvus cluster. This grants the attacker the ability to read, modify, or delete data, and to perform privileged administrative operations such as database or collection management. This issue has been fixed in Milvus 2.4.24, 2.5.21, and 2.6.5. If immediate upgrade is not possible, a temporary mitigation can be applied by removing the sourceID header from all incoming requests at the gateway, API gateway, or load balancer level before they reach the Milvus Proxy. This prevents attackers from exploiting the authentication bypass behavior.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.87%

Chance of exploitation in the next 30 days

Percentile

59%

Versus all other CVEs

30-day change

Decrease -0.19 pp

From 1.05% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Github.com/milvus-io1 product
  • milvus≥ 0.10.4, < 2.4.24 | ≥ 2.5.0, < 2.5.21 | ≥ 2.6.0, < 2.6.5 | < 0.10.3-0.20251107071934-6102f001a971 | ≥ 0.10.4, < 0.10.3-0.20251107071934-6102f001a971
Milvus-io1 product
  • milvus< 2.4.24 | ≥ 2.5.0, < 2.5.21 | ≥ 2.6.0, < 2.6.5

2 vendors · 2 products

References

7 links